Castle

I heard you like free fraud intel 👀 So here’s a dataset of 1063 recent temporary Gmail accounts observed from a provider used for fake account creation (canonical form). gist.github.com/antoinevastel/… One thing that’s interesting: these services often abuse 2 legit Gmail features: - dot variations - plus aliases Example: account1generated@gmail.com becomes: - ac.co.unt1.gen.erated@gmail.com - account1generated+zsh8q@gmail.com Still the same inbox. At @Castle_io , we monitor these ecosystems because they regularly show up in signup abuse / account farming campaigns. Note regarding the dataset: All emails were canonicalized: - dots removed - aliases stripped - gmail/googlemail expanded -> If you correlate against your own signups, make sure you canonicalize emails on your side too.

@Castle_io 's research team just open sourced a disposable email domain list built from real abuse telemetry 🔎 Disposable email providers are a core piece of infrastructure behind fake account creation and signup abuse, similarly to how proxies enable large-scale traffic distribution. A few things we cared about: - curated, not aggregated from public lists - strictly disposable domains - updated daily - ranked by observed abuse prevalence And yes, before someone says it: attackers also use aged Gmail accounts, compromised inboxes, freshly registered domains, etc 😄 Disposable domains are not the whole problem, but they’re still one of the clearest infrastructure-level signals behind large-scale signup abuse. Repo: github.com/castle/disposa…